Actively exploited · Published Aug 16, 2021 · Assigned by mitre
CVE-2021-35394
Critical 9.8 Exploited
In plain English
A critical-severity OS command injection in Jungle Software Development Kit (SDK) from Realtek. Attackers are actively exploiting it in the wild (listed by CISA on December 10, 2021). The chance it is exploited in the next 30 days is estimated at 99.9% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Dec 24, 2021.
Official description
Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memory corruption vulnerabilities and an arbitrary command injection vulnerability that can be exploited by remote unauthenticated attackers.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.securityfocus.com/archive/1/534765 x_refsource_MISC
- https://www.realtek.com/en/cu-1-en/cu-1-taiwan-en x_refsource_MISC
- https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35395.pdf x_refsource_MISC
- https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35394 government-resource